EP2593811A1

EP2593811A1 - Method of processing a satellite navigation signal

Info

Publication number: EP2593811A1
Application number: EP11752312.6A
Authority: EP
Inventors: Tony Bull
Original assignee: Thales Holdings UK PLC
Current assignee: Thales Holdings UK PLC
Priority date: 2010-07-14
Filing date: 2011-07-14
Publication date: 2013-05-22
Also published as: GB2482113A; GB201011866D0; WO2012007720A1

Abstract

In general terms, a mechanism is described for verifying at a remote location, a geo- location determination made at a receiver, by taking advantage of elements of location signals received at that receiver not detectable or alternatively decodable by the receiver. The elements are at least detectable by verification means at the remote location and from which a location determination of receiver can be verified.

Description

Method of Processing a Satellite Navigation Signal

The present disclosure concerns geo-location systems, and particularly geo-location systems using satellite based communications networks. Particularly, but not exclusively, it relates to a method of processing a satellite navigation signal so as to reduce the prospect of an inherent vulnerability leading to erroneous positioning readings being determined as a result of the adverse impact of a third party.

A wide range of technologies now supports the use of geo-location data. Such geo- location data is the result of establishment of global satellite navigation systems (GNSS).

Geo-location information is used for transportation, distribution, manufacturing and emergency services operations, but also in mining, road building and farming. As well as geo-location data, the above referenced satellite systems also provide high precision timing signals which are useful, and indeed now relied upon in critical infrastructure. Examples of these include telephone networks, the internet, banking and electricity supply. Satellite based navigation systems are now commonplace in many environments. In particular, hand held or otherwise mobile devices can now be configured to seek and receive signals broadcast from satellites, and to triangulate from known characteristics of those signals to provide an accurate determination of geo-location. Using mapping technology, such geo-location devices have developed into navigation systems, and information systems. Navigation systems using geo-location have enabled users to determine existing position, and to plan routes to desired destinations, with ease. The availability of a geo-location determination enhances the use of an information system, such that a user can now interrogate a device to find information on local services. This adds convenience, and provides a user with a more relevant search result set than might otherwise be the case.

Thus, a receiver capable of determining a geo-location provides a location reading that can be trusted by the user of the receiver, to the extent that the user trusts the receiver. Of course, over time, the level of trust that a user places in a receiver can develop, on the basis of experience. The reader will appreciate that this level of trust can strengthen or weaken over time.

Various commentators have already noted the vulnerability of such systems to the possibility that a satellite navigation signal can be interfered with to cause erroneous operations. In particular, two problems arise, namely meaconing and jamming. Meaconing involves the (usually malicious) distorted emulation of a satellite signal so as to suggest to a receiver that it is in a location other than its real location. Jamming involves transmitting a signal capable of blocking reception of the relatively wideband and low power satellite signal.

One element of the signal transmitted by the Galileo system is the PRS. This is a protected resilient signal, the details of which are restricted for national security reasons, although the fact that this signal exists is in the public domain. A similar arrangement exists in the Navstar GPS system, wherein the relevant service is known as M code. Where reference is made to PRS code throughout this disclosure, the reader will appreciate that the same statement (or one equivalent thereto, taking account of any relevant technical differences between the GPS and Galileo implementations) can be made with regard to the M code.

Partly by virtue of the fact that knowledge of its construction is restricted, the PRS code is resilient to meaconing and jamming, but is only available for use by authorised PRS receivers. Although the technical details of the PRS (and the GPS equivalent M code) are withheld from the public domain, the fact that this service is resilient to these two vulnerabilities is in the public domain.

One possible technical solution to the problem presented by these vulnerabilities, is to provide authorised PRS or M code receivers to all users in need of a resilient service. However, in view of security restrictions associated with equipment capable of receiving these signals, this is not a practical approach.

US Patent Applications US2009/0195354A1 and US2009/0195443A1 describe an arrangement which recognises the existence of decodable and undecodable elements of a satellite geo-location signal. However, an assumption is made in the disclosure of those two documents that the undecodable elements are unavailable for use in any circumstances, and thus their disclosures focus on detecting the presence of such undecodable elements rather than discovering their nature and using the code for greater accuracy of final result.

An aspect of an embodiment of the invention provides a computer network comprising a plurality of communications broadcasters each operable to generate a unique resilient location signal, to generate a non resilient location signal in which said resilient signal is embedded and to broadcast said location signal, and a receiver operable to receive a resilient location signal and a non-resilient location signal from at least some of said communications broadcasters and to determine, on the basis of said received non resilient location signals, geo-location information defining a geo-location of said receiver, but specifically not capable of determining geo-location from the resilient location signals, said receiver further being operable to send said geo-location information with at least a portion of each of said received resilient location signals to a remote location fixer operable to cross check said portions of said received resilient location signals with said geo-location information, and a timing signal indicative of the time of capture of said received signals at said receiver to enable direction of said cross checking.

By organising the manner in which signals are decoded in a system, and providing a suitably configured system architecture, those actions which must be carried out by authorised entities (and therefore not made available to a regular receiver) can be retained away from a receiver, thus ensuring that the means to decode resilient satellite signals need not be distributed farther than strictly necessary. The fact that a regular receiver cannot decode the resilient signals is no hindrance to the operation of the system. Another aspect of an embodiment of the invention provides a communications network comprising a geo-location receiver and a remotely located geo-location verifier (remote location fixer), the receiver comprising signal detection means operable to detect location signals, each location signal having embedded therein a resilient signal unique to a broadcaster of said location signal, location determination means operable on the basis of said location signals to locally determine a location of said receiver, and communication means operable to emit, to said remote location fixer, location information representing said locally determined location, at least a sample of received location signal information, and local time information representing the time of determination of said locally determined location, said verifier comprising resilient signal extraction means operable to extract, from received location signal information, resilient signal information embedded therein, location determination means operable to determine, on the basis of said extracted resilient signal information and received local time information, a location fix, attack detection means operable to detect attack on said receiver on the basis of comparison of said locally determined location information and said location fix, and feedback means operable to feed back to said receiver the detection, in use, of an attack at said receiver.

Another aspect of an embodiment of the invention provides a receiver comprising detection means operable to detect signals transmitted from communications broadcasters, location determination means operable to determine geo-location of said receiver on the basis of signals detected by said detection means, timing means operable to maintain a timing signal, and retransmission means operable to transmit a signal bearing portions of said detected signals, location assertion data and timing assertion data to a remote location for verification thereof.

Another aspect of an embodiment of the invention provides a computer apparatus for verifying locally determined geo-locations, comprising signal receiving means operable to receive location information representing a locally determined geo-location, at least a sample of received location signal information, and local time information representing the time of determination of said locally determined location, resilient signal extraction means operable to extract, from received location signal information, resilient signal information embedded therein, location determination means operable to determine, on the basis of said extracted resilient signal information and received local time information, a location fix, attack detection means operable to detect attack on said receiver on the basis of comparison of said locally determined location information and said location fix, and feedback means operable to feed back to said receiver the detection, in use, of an attack at said receiver.

Another aspect of an embodiment of the invention provides a method of processing a geo-location assertion comprising receiving location information representing a locally determined geo-location, at least a sample of received location signal information, and local time information representing the time of determination of said locally determined location, extracting, from received location signal information, resilient signal information embedded therein, determining, on the basis of said extracted resilient signal information and received local time information, a location fix, and comparing said locally determined location information with said location fix in order to determine if the generator of said received locally determined location information experienced attack at the time said locally determined location information was determined.

Another aspect of an embodiment of the invention provides a method of detecting a meaconing or jamming attack on a GNSS receiver, that uses the resilient signals embedded within GNSS signals as covert digital watermarks, which in turn are resilient to removal by an attacker and therefore act as witnesses of the original location and allow the specific perversion of the open signal undertaken by an attacker to be characterised.

In general terms, an aspect of an embodiment of the invention provides a mechanism for verifying at a verification means, a location determination made at a location means, by taking advantage of elements of location signals received at that location not detectable or alternatively decodable by the location means, said elements being at least detectable by said verification means and from which a location determination of said location means can be verified.

Another aspect of the invention provides a system for determining a geo-location, comprising:

a constellation of satellites, each operable to transmit a first signal and a second signal; a receiver operable to receive the first and second signal from one or more of said satellites and comprising:

signal detecting means operable to detect the first signal, but incapable of detecting the second signal;

local timing means operable to generate a local timing signal,

location information determining means operable to determine geo-location information from said received first signal, the geo-location information describing at least a locus of possible locations of said receiver and location information sending means operable to emit a receiver signal comprising said geo-location information, at least a sample of said one or more received first and second signals, and side information comprising said local timing signal; and

a location fixer operable to receive a receiver signal from a receiver,

signal detecting means operable to detect said one or more second signals from said one or more samples,

location fix determining means operable to determine a location fix from said second signals by correlation with local knowledge of said second signals, said correlation being focused on the basis of said local timing signal.

Further aspects, details and advantages will become apparent from the following description of specific embodiments of the invention. In the following, the reader will appreciate that the specific may be generalised, and where a particular means of performing an action is described, no limitation is thereby inferred on the scope of protection sought in the present case.

Figure 1 is a schematic diagram of a satellite enabled communications network in accordance with a specific embodiment of the invention;

Figure 2 is a schematic diagram of a receiver of the communications network illustrated in Figure 1 ;

Figure 3 is a schematic diagram of a location calculator of the receiver illustrated in Figure 2;

Figure 4 is a schematic diagram of a data packet for transmission by the receiver to a remote location fixer as illustrated in figure 1 ; Figure 5 is a flow diagram illustrating typical operation of the receiver as illustrated in figure 2; and

Figure 6 is a flow diagram illustrating typical operation of the remote location fixer of the specific embodiment of the invention. As shown in Figure 1 , a communication system embodying an example of the present invention is illustrated. The system 10 comprises a base station 20, a constellation of geo-orbital satellites 30 (of which four are illustrated for simplicity), a wireless receiver 40, and a remote location fixer 80.

The base station 20, satellites 30, and receiver 40 generally form the basis for a commonplace geo-location system. The example below is illustrative of the GPS system which is a US government sponsored system, because publicly available information about GPS will augment the understanding of the invention. The reader will understand that the Galileo system, in development by the European Space Agency, COMPASS (by the Chinese Space Agency) and GLONASS (currently under redevelopment by the Russian and Indian space agencies) operate on similar principles. Each satellite 30 transmits a location signal towards Earth, with a unique resilient location signal embedded in the location signal. The receiver 40 is able to receive location signals from the satellites 30. For each signal, the receiver 40 identifies the signal in terms of the satellite 30 from which the signal has been transmitted, and recovers timing delays of the signal from the satellite. On the basis of prior knowledge of positions of satellites 30 (or on the basis of recoverable position information carried on the received signal), and triangulation of the relative time of receipt of satellite signals, the receiver 40 is able to calculate its location.

The base station 20 controls the constellation of satellites 30, providing support and configuration signals as the need arises. Each satellite 30 broadcasts a navigation signal. This navigation signal bears information which, in part, can define a number of services, using various manners of encoding. In GPS (and as expected to be implemented in Galileo), a basic navigation signal (such as the Galileo Open Service, comprising a satellite clock signal and satellite location information) is broadcast with CDMA encoding, encoded with a publicly available spreading code.

A resilient covert signal is broadcast alongside this basic navigation signal. The resilient covert signal is generated in a way which is not known to the receiver, and which can only be decoded by authorised users. In the context of the above introduction, examples of this more extensive signal are the PRS signal (Galileo system) and the M-code signal (GPS system).

In this embodiment, further functionality, beyond the above relatively commonplace features of typical geolocation systems, provides a third party with additional knowledge of the way in which the resilient covert signal is generated and therefore is able to obtain a location fix from this resilient covert signal.

As illustrated, the base station 20 controls the satellite to maintain position and to maintain an accurate on board absolute time reference. The satellites 30 encode a timing signal, synchronised to the on board absolute time reference, with their own unique codes. In this example, Gold codes are used as the timing signal, each Gold code being unique to the satellite concerned. These encoded signals are then transmitted back to earth. The receiver 40 receives signals from available satellites. In this embodiment, the receiver 40 typically receives signals from four (or more) satellites. It will be understood that geo-location can be attempted using the signals from three satellites but doing so requires knowledge of absolute time, which is usually not possible and would preclude later verification of the location on the remote location fixer 80. By using the fourth satellite signal, such knowledge of absolute time can be eliminated from the geo-location calculation (which is essentially a simultaneous equation calculation to eliminate unknown variables).

In an alternate embodiment, where fewer than four satellite signals are received, a system may rely on alternate information about the location of the receiver, such that a reliable location fix is still potentially recoverable. For example, if a receiver on an aeroplane captures only three signals, a remote location fixer would only be able to specify the location of the receiver to a locus of points that is formed by a constant distance calculated form two of the satellites, which is a circle. Since a typical aircraft comprises in its avionics an accurate altimeter, it is possible for the avionics to supply an altimeter reading to allow an accurate location fix to be determined. If an attempt to arrive at a location fix leads to an ambiguous result, such as if the geometric problem presented by the available information has two or more possible solutions, it is likely that further information will be available, such as the route plan of the aircraft, which will reduce or eliminate this ambiguity. Thus, such an embodiment could provide imperfect satellite information, supplemented by additional non-satellite information, to enable a remote location fixer to confirm a location assertion made on board such an aircraft.

More generally, other embodiments can be envisaged which take advantage of features of the above disclosure to establish a location fix.

As has previously been stated, a location fix (x,y,z,t) has four variables and therefore needs to observe the navigation signal from 4 GNSS satellites to provide the four knowns in order to resolve the four simultaneous equations and provide a four dimensional location fix.

If fewer than four satellites are observable by a receiver, and thus fewer than four satellite signals received at the receiver, then mathematically it is impossible to derive a unique location, but it is possible to derive a set of possible locations. Such a set of possible locations may still be useful.

If three satellites are observed, the locus of valid points is a circle, described by fixed distances from two of the satellites. This circle will usually (depending on the specific topography of the observed satellites) pass through space and intersect the surface of the earth at two points. In many circumstances, a receiver will be tied to a constrained domain. For example, a ship is usually at sea level, and so this can be used to provide an additional input to the simultaneous equations used for triangulation of the receiver's position, meaning that a location fix may still be possible with three satellites.

A number of applications of the above principle can use such additional information, with the GNSS information, to recover an unambiguous location fix:

• A ship is constrained to always be at sea level;

· Aircraft have highly accurate altimeter readings that place them in a constrained sphere around the earth;

• Trains have a complex but highly constrained locus of movement on rail tracks; and

• Cars are constrained to remain at ground level and usually close to a road. It will be appreciated that, for land based vehicles, it may be necessary to obtain information about local topography and relief features to be able to establish the constrained locus of such vehicles. For two satellites, the locus of valid points is a sphere and with other information, may still reveal useful information about the location of the receiver. The intersection of the valid locus with the constrained locus of a receiver can be used with further information about the likely location of the receiver to provide a more accurate fix on the location of the receiver. For instance, if a receiver is on a ship, it can again be assumed that the constrained locus of the receiver is the surface of the earth and thus that the locus of valid points defined by a discernible fixed distance from a given satellite will intersect the constrained locus at a generally circular line (taking account of the non-spherical nature of the earth's surface) traced on the surface of the earth. If further information can be relied upon, such as course, compass bearings, local time, and so on, then the location fixer would be able to establish a suitable location fix for use by the ship.

In extremis, where only one satellite is observed, there is still potential value in this solution. A receiver at a known physical location, observing just one satellite, can still recover a location fix in time, which has significant value in providing highly accurate time stamping and accurate clock provision (equivalent to the GNSS system clock accuracy). This is possible because the known exact location of a fixed receiver, including the known position of the satellite at that moment, provides a value for the delay experienced in transmission from satellite to ground. This in turn can be removed from the inaccuracy in absolute time of the receiver's clock.

The covert resilient signal (details of which are not relevant to this disclosure) comprises a stream of time varying binary information. The resilient signal is, in this embodiment, generated by the satellite. The method by which the time varying signal is produced is known to the remote location fixer 80 but not the wireless receiver 40. It is only necessary to specify here that the remote location fixer 80 should be able to refer back, on request, to determine what the resilient signal was at a particular time, for a particular satellite, or to regenerate, on request, the resilient signal produced at that time. The resilient signal is spread across the useful spectrum of the signal, with a spreading method not known to the wireless receiver 40 - again, it is not necessary for an understanding of the invention for a detailed example of this commonplace approach.

In normal circumstances, the receiver 40 passes forward its location fix, i.e. its own calculation of geo-location, together with those portions of the satellite signals on the basis of which it has calculated its location fix. These signals are passed to the remote location fixer 80. The remote location fixer 80 assesses, on the basis of the received information, whether the location assertion corresponds with the extracted resilient signals. On that basis, it passes back a message to the receiver 40 confirming or refuting the location fix, and providing a location fix derived from the resilient signal

If the receiver location fix is refuted, the Remote Location Fixer 80 might reasonably assume that the receiver 40 is the victim of a jamming or meaconing attack. Further investigation of the characteristics of signal will enable the Remote Location Fixer to characterise the type of attack as crude jamming or a more sophisticated spoofing that is known as meaconing.

Jamming and meaconing attacks generally have certain characteristics such as will now be described, that can be detected by the remote location fixer of the present specific embodiment.

Jamming is characterised by the masking of a non resilient signal by a high level of co channel noise, making a correlation peak at a detector either invisible or subject to large error due to low signal to noise ratio. Therefore, if the RLF also finds a low correlation peak height when correlating against the resilient covert signal, it can deduce that the receiver is being subjected to a crude jamming attack.

In meaconing, the attacker emulates the non resilient signal, but with altered relative timings arriving at the receiver. In that way, the receiver will determine a geo-location calculation which is consistent with the received (emulated) signals, but probably inconsistent with the real location of the receiver. A user of such geo-location information would then be misdirected into believing that the receiver is at a location other than its real location. Due to its nature, this is often termed a "spoofing" attack. In order to detect meaconing, the remote location fixer can observe one of two characteristics, depending on the type of attack.

In a first case, the receiver is isolated from the real environment, for example by enclosing it in a metal box, and fed a synthesized erroneous signal. In this case, there can be no embedded resilient covert signal in the location stamp, because the security surrounding the generation of the resilient covert signal prevents the attacker from being able to accurately synthesise it. This inconsistency in the level of the non resilient signal is indicative of this attack.

In a second type of meaconing attack, the attacker captures satellite signals off air and uses knowledge of the non-resilient signal spreading codes to channelise the signal from each of the satellites, then to re-combine the signals at different relative timings in order to spoof the receiver location. In this case, the use of the non resilient spreading code, to channelise the signal, means that the resilient covert code is not corrupted and can be used to show that the timing of the receiver has been manipulated, indicating this type of meaconing attack.

As shown in Figure 2, the means by which the receiver 40 receives and processes signals is illustrated. The receiver comprises an antenna 41 operable to receive signals transmitted by geo-orbiting satellites 30. These signals are passed through an amplifier 42 and are frequency shifted down 44. The resultant signal is passed through an analogue to digital converter (ADC) 46. The digital signal is then passed to a location calculator 48 and to a signal capture store 50. The signal capture store 50 stores information relating to a portion of signal processed by the location calculator, which includes the noise like resilient signal hidden within the noise of the captured signal. Figure 3 illustrates the location calculator in more detail, comprising a plurality of correlators 62 each set to a particular satellite signal encoding, and the correlated signals therefrom being sent to a DSP 64.

The DSP 48 performs a calculation, on the basis of the received information and therefore the correlated signals, by means of triangulation of three (or preferably four) satellite signals, to derive a location assertion. This location assertion is then passed to the signal capture store 50 for storage in association with the digitised original signals. These signals are passed to a controller 54, which controls overall operation of the device, and which passes information to a WAN unit 52. The WAN unit 52 is operable to generate a communication channel over a wide area network (WAN), for transmission of the location assertion, and the associated digitised original signals, to the remote location fixer 80.

Transmission of location assertions over the WAN will inevitably encounter delays, inherent to the operation of WANs as they are currently understood. Such delays will only be significant to the operation of an arrangement in accordance with the present embodiment of the invention, to the extent that the user requires a particular response time. Different implementations of the embodiment will require different response times, ranging from milliseconds for real time applications such as navigation back up systems, to potentially months for Meaconing investigators, where the WAN may be implemented by way of off line email/CD ROM transmission.

It will be appreciated that a communications channel with the remote location fixer could be established by way of the same antenna as detects the satellite location signals, but that this may not be technologically possible in all cases.

An internal clock 56 is also provided. The clock 56 can be updated from received satellite signals when location is confidently known by the operator and thus the clock signal from satellite signals can be trusted, or if a timing signal can be received from another trusted source. In accordance with this embodiment, the clock is sufficiently reliable to be able to withstand short term variations (e.g. in the order of one or two days) but will accept updates from time to time, in frequency somewhat slower than that, to retain a reasonable estimate of absolute time, that is resistant to a slow but significant drift of GNSS derived time that would be characteristic of a very sophisticated meaconing attack.

The term "absolute" is used in its conventional sense here, and is not intended to suggest that any measure of time is anything other than relative to some generally accepted and adopted standard, such as (but not limited to) Universal Time. The reader will appreciate that the above is but one approach to the provision of an internal clock with reliability and accuracy, and that the invention is not bound to that implementation. The particular requirements of reliability as set out above are specific to the provided example, and are not intended to act as a limitation on any scope of protection afforded any invention described herein.

In use, the signal from the internal clock 56 accompanies all other communications as a local assertion of standard time. This is included in a Location Stamp 90 which is sent by the receiver as set out above, in a format as illustrated in figure 4. As shown in figure 4, the Location Stamp is a packet of data comprising a Receiver Location Fix field 91 containing data describing the location fix calculated by the receiver 40 itself by triangulation methods, a Signal Capture field 92 containing digitised samples of the signals on the basis of which the receiver determined location fix was generated, a Receiver Time field 93 providing a reading from the internal clock 56 of the receiver 40, and an "Other" field 94 which can be used (such as in this example) for a digital signature.

In use, the remote location fixer 80 will be able to assess, on the basis of the original data, and the location assertion, if the location assertion can correspond with the satellite positions at the time the portion of resilient signal contained in the original was received by the receiver 40. That is, the receiver 40 receives a "signature" on the signals received from the satellites 30, which it is not capable of replicating, because it does not have knowledge of the manner in which the resilient signal was originally generated. In addition, it will not have knowledge of the manner in which the resilient signal is spread across the spectrum. Accordingly, the remote location fixer 80 is able to establish, from its records, whether the resilient signals are present, and whether they concur with the location fix, or whether they imply that the receiver has become subject to a meaconing or jamming attack. In an alternative case, where the receiver does not provide the location assertion to the remote location fixer 80, the remote location fixer 80 would in theory need to be capable of performing a search through all historical resilient signal spreading codes, and provide location information to the receiver 40 for comparison with the location assertion. This might place undue workload on the remote location fixer 80 and introduce unacceptable inaccuracies. However, it might be useful in cases where, for whatever reason, the receiver 40 is not capable of providing its own location fix, even for time alone.

To enable this situation to be practically implemented, and as previously noted, the receiver 40 supplies a time assertion to the remote location fixer 80. By applying a search constraint based on this time assertion, the authenticator's task is made practical, from the perspective of computational complexity.

Thus, if the remote location fixer 80, in verifying received information, identifies a discrepancy between the asserted location and the associated satellite signals, leading to a location verification failure, it then explores where and when the location assertion was actually taken. To do this, it refers back, on the basis of the extracted authentication signals, and provides location information to the remote location fixer 80 for comparison with the location assertion. This, again, can be implemented practically by relying on the time assertion as a starting point for (or constraint on) any search conducted by the authenticator.

Therefore, in summary, in the above arrangement, the GNSS receiver 40 will capture a "Location Stamp", which contains:

· A claimed location in time and space (x,y,z,t)

• A raw off-air signal capture, containing the hidden Resilient Service (PRS or M- Code) signals which act as the covert digital watermark of the time and location the stamp was created.

• Identities and signatures etc.

The above arrangement focuses on deriving a location fix using the covert embedded resilient signal, whether or not the location stamp is taken at the claimed location. This location fixing is possible, because the embedded resilient signal is more resilient to meaconing and jamming than the non resilient open services such as the Galileo OS and the GPS CA code.

By the provision of a time assertion in the signal from the receiver, it is possible to use the Resilient Service signal embedded in the raw signal of the location stamp to recover a location fix, even under jamming and meaconing conditions. This is because by providing a realistic (and probably sufficiently accurate) indication of the time at which the location stamp was taken is known, the search for a correlation peak can be limited to a relatively small correlation window.

Knowledge of the time fix can be used to constrain the size of the correlation window across which the remote location fixer 80 must search for correlation peaks using the Resilient Service spreading codes.

An example will illustrate the scale of this problem, and how the present embodiment as described above can rationalise the complexity which would arise without limitation on the search window applied at the correlator of the remote location fixer 80.

If a geo-location accuracy of less than 1 metre is required, time is related to distance by the speed of propagation of the navigation signals between the satellite and the receiver. The skilled person in the field of the present disclosure will appreciate that the timing accuracy therefore implied to achieve 1m accuracy is approximately 10^"9 seconds. This thus requires a correlator search resolution of 10^"9 seconds or better.

Table 1 accordingly illustrates the number of multiplication functions that a correlator would be required to perform at each resolution point to find the correlation peak, for different levels of independent clock accuracy.

Table 1

As can be seen, it is important to maximise the accuracy of the independent receiver time fix, as it dictates the size of the correlation window and large windows are computationally expensive, as well as introducing inaccuracy due to the greater statistical likelihood of false correlation peaks and associated location fix errors. In the case that a Resilient Service GNSS receiver is subject to jamming or meaconing, service is lost, or worse, a "claimed location" obtained by the receiver would likely be highly inaccurate. Thus a Location Stamp obtained by the GNSS receiver and sent to the remote location fixer can be used to authenticate the actual location of the receiver.

A failure to authenticate the receiver location serves as a warning that the GNSS signals is being Jammed or Meaconed. Thus the remote location fixer 80 according to this embodiment also serves as a robust and efficient meaconing detector and has significant benefit in its own right.

In addition, to mitigate the jamming and meaconing further, the remote location fixer 80 not only returns a warning that the receiver is being jammed/meaconed, but also it derives a location fix from the embedded Resilient Service codes. Thus a receiver on the open service, subject to jamming or meaconing, can still obtain an accurate location fix from the resilient signal, even though it does not directly have access to the resilient signal spreading codes.

Moreover, the present embodiment provides additional facility to the remote location fixer 80, as the limited duration of the sample available in a location stamp, could otherwise increase the risk of a false positive in the correlation peak search.

A flow diagram illustrating the manner in which the present embodiment operates at the receiver is illustrated in figure 5. In step S1-2 a location stamp in accordance with figure 4 is generated, on the basis of a locally determined geo-location. This location stamp 90 is sent to the remote location fixer 80.

The remote location fixer operates in accordance with a process as illustrated by way of a further flow diagram in figure 6. In step S2-2 of figure 6, a location fix packet 90 has been received from a receiver 40. The sample data from this is extracted in step S2-4 and, in step S2-6, the sample ^"data is correlated with the knowledge of the remote location fixer 80 (and with the aid of the timing data contained in the packet 90) of the restricted signals which should have been transmitted by the satellites. From this, a location fix can be determined in step S2-8. In step S2-10, a comparison is made between the location fix so calculated, and that submitted by the receiver 40. If these match, or are similar to a reasonable degree of tolerance, then a determination is made that there is no meaconing or jamming attack under way, and the location fix is returned to the receiver (in step S2-14) as enhanced information for its use. On the other hand, if there is sufficient difference between the two location calculations, then it can be determined that an attack is under way, and this is signalled to the receiver, along with the location fix, in step S2-12. Therefore, in step S1-6 of the process illustrated in figure 5, the receiver 40 in receipt of a message from the remote location fixer 80 will determine therefrom if an attack is under way (step S1-8). If not, then the locally generated location stamp can be used (although it may be convenient to use the location fix generated by the remote location fixer 80). If so, however, then the location fix received from the remote location fixer 80 is used in all circumstances.

The reader will appreciate that it might only be necessary to transmit the remotely determined location fix if a meaconing or jamming attack has been detected, but it may be convenient to do so at all times in view of the fact that the data has been generated anyway.

In the Galileo system, diversity is used to provide greater resilience to the service, by transmitting the PRS signal on the E6 and L1 bands. For receivers using the service in accordance with the present embodiment, it will be necessary to use this diversity to overcome the extra co-channel interference of the Jamming and Meaconing attacks. This is useful, in that an attacker mounting an attack, needs to jam across two channels instead of one and, in a more sophisticated attack, needs to manipulate the two signals instead of one, making the task much more difficult without leaving suspicious inconsistencies between the channels.

Accordingly, without having access to the PRS/M code, a general purpose receiver^" can obtain resilience to jamming and meaconing as if it were specified for use with such code. Although the above embodiments have been described regarding system architecture, structure and function, the reader will understand that certain aspects and features thereof can be implemented by way of interaction of general purpose components configured by suitable software. The reader will appreciate that aspects of the above described embodiments may thus encompass software based implementations, executable on general purpose hardware. Such software implementations may include computer readable storage media, or signals bearing computer executable instructions, in the conventional manner. The scope of the present invention should not be so limited that further implementations by software and hardware means not specifically described above should be considered excluded.

While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel methods and systems described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.

Claims

CLAIMS:

A system for determining a geo-location, comprising:

a constellation of satellites, each operable to transmit a first signal and a second signal;

a receiver operable to receive the first and second signal from one or more of said satellites and comprising:

first signal detecting means operable to detect the first signal, but incapable of detecting the second signal;

local timing means operable to generate a local timing signal,

location information determining means operable to determine geo-location information from said received first signal, the geo-location information describing at least a locus of possible locations of said receiver and

location information sending means operable to emit a receiver signal comprising said geo-location information, at least a sample of said one or more received first and second signals, and side information comprising said local timing signal; and

a location fixer operable to receive a receiver signal from a receiver,

second signal detecting means operable to detect said one or more second signals from said one or more samples,

A system in accordance with claim 1 wherein said side information comprises information about the nature of the receiver, defining a constrained locus of possible locations of said receiver.

A system in accordance with claim 1 or claim 2 wherein said first signal for each satellite is a signal spread by a spreading code, spreading codes being allocated to satellites to enable distinction of one satellite from another, the first signal detecting means comprising correlator means attuned to each of said satellite signals.

4. A system in accordance with claim 3 wherein the spreading codes identify said satellites uniquely.

5. A system in accordance with any preceding claim wherein the first signal is a non- resilient signal. 6. A system in accordance with any one of the preceding claims wherein said second signal from each satellite is a signal spread by a spreading code restricted from access by said receiver.

7. A system in accordance with any preceding claim wherein the second signal is a resilient signal.

8. A system in accordance with any one of the preceding claims wherein said side information comprises identification information identifying the receiver. 9. A system in accordance with any one of the preceding claims wherein said side information comprises route information determined by or for the receiver.

10. A system in accordance with any one of the preceding claims wherein said side information comprises constrained locus information defining a constrained locus within which said receiver should, in use, be located.

11. A system in accordance with any one of the preceding claims wherein said side information comprises locally generated positioning information describing a position, in at least one degree of freedom, of said receiver.

12. A system in accordance with claim 1 1 wherein said receiver comprises position measuring means operable to determine locally generated positioning information describing a position, in at least one degree of freedom, of said receiver. 13. A system in accordance with claim 12 wherein said position measuring means comprises an altimeter and said locally generated positioning information comprises an altitude of said receiver.

14. A computer network comprising a plurality of communications broadcasters each operable to generate a unique resilient signal, to generate a location signal in which said resilient signal is embedded and to broadcast said location signal, and a receiver operable to receive location signals from at least some of said communications broadcasters and to determine, on the basis of said received location signals, geo-location information defining a geo-location of said receiver, said receiver further being operable to send said geo-location information with at least a portion of each of said received location signals to a remote location fixer operable to cross check said received location signals in which said unique resilient signals are embedded with said geo-location information, and a timing signal indicative of the time of capture of said received signals at said receiver, to enable direction of said cross checking.

15. A computer network in accordance with claim 14 wherein each said resilient signal is defined by a code, knowledge of which is restricted to a set of authorised entities, said remote location fixer being a member of said set of authorised entities.

16. A computer network in accordance with claim 14 or claim 15 wherein said receiver comprises timing means operable to generate said timing signal.

17. A computer network in accordance with claim 14 or claim 15 wherein said receiver comprises timing information acquisition means operable to acquire, from a source other than one of said broadcasters, timing information on the basis of which to generate said timing signal.

18. A computer network in accordance with any one of claims 14 to 17 wherein said remote location fixer is operable to detect, on the basis of said cross checking, whether said location signal is indicative of system attack.

19. A computer network in accordance with claim 18 wherein said remote location fixer is operable to determine if said resilient signal is properly embedded in said location signal, such that a system attack can be identified.

20. A computer network in accordance with claim 18 wherein said remote location fixer is operable to determine if said resilient signal, embedded in said location signal, is consistent with said location signal, such that a system attack can be identified.

21. A communications network comprising a geo-location receiver and a remotely located geo-location fixer,

the receiver comprising signal detection means operable to detect location signals, each location signal having embedded therein a resilient signal unique to a broadcaster of said location signal, location determination means operable on the basis of said location signals to locally determine a location of said receiver, and communication means operable to emit, to said geo-location verifier, location information representing said locally determined location, at least a sample of received location signal information, and local time information representing the time of determination of said locally determined location,

said fixer comprising resilient signal extraction means operable to extract, from received location signal information, resilient signal information embedded therein, location determination means operable to determine, on the basis of said extracted resilient signal information and received local time information, a location fix, attack detection means operable to detect attack on said receiver on the basis of comparison of said locally determined location information and said location fix, and feedback means operable to feed back to said receiver the detection, in use, of an attack at said receiver.

22. A receiver comprising detection means operable to detect signals transmitted from communications broadcasters, location determination means operable to determine geo-location of said receiver on the basis of signals detected by said detection means, timing means operable to maintain a timing signal, and retransmission means operable to transmit a signal bearing portions of said detected signals, location assertion data and timing assertion data to a remote location for verification thereof.

23. Apparatus for verifying locally determined geo-locations, comprising signal receiving means operable to receive location information representing a locally determined geo-location, at least a sample of received location signal information, and local time information representing the time of determination of said locally determined location,

resilient signal extraction means operable to extract, from received location signal information, resilient signal information embedded therein, location determination means operable to determine, on the basis of said extracted resilient signal information and received local time information, a location fix, and attack detection means operable to detect attack on said receiver on the basis of comparison of said locally determined location information and said location fix.

24. Apparatus in accordance with claim 23 and comprising feedback means operable to feed back to said receiver the detection, in use, of an attack at said receiver.

25. Apparatus in accordance with claim 24 and wherein said feedback means is operable to feed back to said receiver information as to the nature of a detected attack.

26. Apparatus in accordance with claim 25 and wherein said feedback means is operable to feed back to said receiver an indication of a jamming attack.

27. Apparatus in accordance with claim 25 and wherein said feedback means is operable to feed back to said receiver an indication of a meaconing attack.

28. Apparatus for determining if a geo-location device has been subject to an attack, comprising signal receiving means operable to receive a sample of location signal information represented to have been acquired at said geo-location device, and local time information representing the time at which said sample is represented to have been acquired,

resilient signal extraction means operable to extract, from received location signal information, resilient signal information embedded therein,

location determination means operable to determine, on the basis of said extracted resilient signal information and received local time information, a location fix, and attack detection means operable to detect attack on said geo-location device. 29. Apparatus in accordance with claim 28 wherein said attack detection means is operable to detect attack on the basis of absence of detection, by said resilient signal extraction means, of a resilient signal embedded in said sample or samples.

30. Apparatus in accordance with claim 28 or claim 29 wherein said signal receiving means is further operable to receive location assertion information from said geo- location device, wherein said attack detection means is operable to detect attack on the basis of inconsistency between said location assertion information and said location fix. 31. Apparatus in accordance with any one of claims 28 to 30 wherein said attack detection means is operable to detect attack on the basis of inconsistency between said received local time information and time information derivable from said resilient signal information. 32. A method of processing a geo-location assertion comprising receiving location information representing a geo-location determined at a geo-location device, at least a sample of received location signal information, extracting, from received location signal information, resilient signal information embedded therein, determining, on the basis of said extracted resilient signal a location fix, and comparing said locally determined location information with said location fix in order to determine if the generator of said received locally determined location information experienced attack at the time said locally determined location information was determined. 33. A method in accordance with claim 32 and including comparing said extracted resilient signal with a locally generated resilient signal, to determine authenticity of said extracted resilient signal.

34. A method in accordance with claim 33 wherein said comparing comprises determining a power level of said extracted resilient signal against a norm, to determine if the generator of said received locally determined location information experienced attack.

35. A method in accordance with claim 33 or claim 34 and including extracting, from said received location signal information, timing information included by the geo- location device, and using said timing information to focus said comparing on a portion of said locally generated resilient signal corresponding to said timing signal.

36. A method in accordance with any one of claims 32 to 35 and including extracting, from said received location signal information, locus definition information defining a locus of possible locations of said geo-location device, and using said locus definition information alongside said received location signal information to determine a fix on location of said geo-location device. 37. A computer program product comprising computer executable instructions which, when executed by a general purpose computer, cause said computer to be configured as computer apparatus in accordance with any one of claims 23 to 31.

38. A computer program product comprising computer executable program instructions which, when executed by a general purpose computer, cause said computer to perform a method in accordance with any one of claims 32 to 36.